[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.15' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 89.468497][ T35] audit: type=1400 audit(1611377669.669:8): avc: denied { execmem } for pid=8487 comm="syz-executor304" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 [ 89.502562][ T8488] IPVS: ftp: loaded support on port[0] = 21 [ 89.548834][ T35] audit: type=1107 audit(1611377669.749:9): pid=8488 uid=0 auid=0 ses=5 subj=system_u:system_r:kernel_t:s0 msg='7O!`wfe7pTK)օN [ 89.548834][ T35] k?)={|o8GcRBi%Tױ9k [ 89.548834][ T35] -R{;w6WQ"mBTA~}̿9$4UyncW4$@3]m'Q;kevw}γ)bwLowE` =ABaX>1R3(cH]sVE@ ]]ޱx2K}Swu'd^|T(iLm&j%g|L"~\P4a$e./㠣Ȏ~iS&oX6iaOLۊYx^EC{AJCU\ "qot.}WS' [ 89.551313][ T35] ================================================================== [ 89.551325][ T35] BUG: KASAN: global-out-of-bounds in record_print_text+0x33f/0x380 [ 89.551331][ T35] Write of size 1 at addr ffffffff8f08d01e by task kauditd/35 [ 89.551340][ T35] [ 89.551344][ T35] CPU: 1 PID: 35 Comm: kauditd Not tainted 5.11.0-rc4-syzkaller #0 [ 89.551351][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 89.551356][ T35] Call Trace: [ 89.551359][ T35] dump_stack+0x107/0x163 [ 89.551363][ T35] ? record_print_text+0x33f/0x380 [ 89.551367][ T35] ? record_print_text+0x33f/0x380 [ 89.551371][ T35] print_address_description.constprop.0.cold+0x5/0x2c6 [ 89.551376][ T35] ? record_print_text+0x33f/0x380 [ 89.551379][ T35] ? record_print_text+0x33f/0x380 [ 89.551383][ T35] kasan_report.cold+0x79/0xd5 [ 89.551387][ T35] ? record_print_text+0x33f/0x380 [ 89.551391][ T35] record_print_text+0x33f/0x380 [ 89.551395][ T35] ? get_record_print_text_size+0x110/0x110 [ 89.551399][ T35] ? prb_read_valid+0x75/0xa0 [ 89.551402][ T35] ? prb_final_commit+0x20/0x20 [ 89.551406][ T35] ? console_unlock+0x850/0xbb0 [ 89.551410][ T35] console_unlock+0x318/0xbb0 [ 89.551413][ T35] ? devkmsg_read+0x740/0x740 [ 89.551417][ T35] ? lock_release+0x710/0x710 [ 89.551420][ T35] ? vprintk_func+0x8d/0x1e0 [ 89.551424][ T35] vprintk_emit+0x189/0x490 [ 89.551427][ T35] vprintk_func+0x8d/0x1e0 [ 89.551430][ T35] printk+0xba/0xed [ 89.551434][ T35] ? record_print_text.cold+0x16/0x16 [ 89.551438][ T35] ? lockdep_hardirqs_on+0x79/0x100 [ 89.551442][ T35] ? _raw_spin_unlock_irqrestore+0x2f/0x50 [ 89.551446][ T35] ? ___ratelimit+0x21c/0x460 [ 89.551450][ T35] kauditd_hold_skb.cold+0x41/0x50 [ 89.551453][ T35] ? auditd_pid_vnr+0x230/0x230 [ 89.551457][ T35] kauditd_send_queue+0x19d/0x210 [ 89.551461][ T35] ? audit_log_lost+0x180/0x180 [ 89.551464][ T35] kauditd_thread+0x7f0/0xb80 [ 89.551468][ T35] ? auditd_reset+0x170/0x170 [ 89.551471][ T35] ? finish_wait+0x260/0x260 [ 89.551475][ T35] ? lockdep_hardirqs_on+0x79/0x100 [ 89.551479][ T35] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 89.551484][ T35] ? __kthread_parkme+0x13f/0x1e0 [ 89.551487][ T35] ? auditd_reset+0x170/0x170 [ 89.551491][ T35] kthread+0x3b1/0x4a0 [ 89.551494][ T35] ? kthread_create_worker_on_cpu+0xf0/0xf0 [ 89.551498][ T35] ret_from_fork+0x1f/0x30 [ 89.551501][ T35] [ 89.551504][ T35] The buggy address belongs to the variable: [ 89.551509][ T35] console_waiter+0x3e/0x40 [ 89.551512][ T35] [ 89.551515][ T35] Memory state around the buggy address: [ 89.551520][ T35] ffffffff8f08cf00: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 [ 89.551527][ T35] ffffffff8f08cf80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 [ 89.551533][ T35] >ffffffff8f08d000: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 [ 89.551538][ T35] ^ [ 89.551543][ T35] ffffffff8f08d080: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 f9 f9 [ 89.551549][ T35] ffffffff8f08d100: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 [ 89.551555][ T35] ================================================================== [ 89.551561][ T35] Disabling lock debugging due to kernel taint [ 89.551566][ T35] Kernel panic - not syncing: panic_on_warn set ... [ 89.551572][ T35] CPU: 1 PID: 35 Comm: kauditd Tainted: G B 5.11.0-rc4-syzkaller #0 [ 89.551579][ T35] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 89.551584][ T35] Call Trace: [ 89.551587][ T35] dump_stack+0x107/0x163 [ 89.551591][ T35] ? record_print_text+0x2e0/0x380 [ 89.551594][ T35] panic+0x306/0x73d [ 89.551597][ T35] ? __warn_printk+0xf3/0xf3 [ 89.551601][ T35] ? record_print_text+0x33f/0x380 [ 89.551605][ T35] ? record_print_text+0x33f/0x380 [ 89.551609][ T35] ? record_print_text+0x33f/0x380 [ 89.551612][ T35] end_report+0x58/0x5e [ 89.551616][ T35] kasan_report.cold+0x67/0xd5 [ 89.551619][ T35] ? record_print_text+0x33f/0x380 [ 89.551623][ T35] record_print_text+0x33f/0x380 [ 89.551627][ T35] ? get_record_print_text_size+0x110/0x110 [ 89.551631][ T35] ? prb_read_valid+0x75/0xa0 [ 89.551635][ T35] ? prb_final_commit+0x20/0x20 [ 89.551638][ T35] ? console_unlock+0x850/0xbb0 [ 89.551642][ T35] console_unlock+0x318/0xbb0 [ 89.551646][ T35] ? devkmsg_read+0x740/0x740 [ 89.551649][ T35] ? lock_release+0x710/0x710 [ 89.551653][ T35] ? vprintk_func+0x8d/0x1e0 [ 89.551656][ T35] vprintk_emit+0x189/0x490 [ 89.551659][ T35] vprintk_func+0x8d/0x1e0 [ 89.551663][ T35] printk+0xba/0xed [ 89.551666][ T35] ? record_print_text.cold+0x16/0x16 [ 89.551670][ T35] ? lockdep_hardirqs_on+0x79/0x100 [ 89.551674][ T35] ? _raw_spin_unlock_irqrestore+0x2f/0x50 [ 89.551678][ T35] ? ___ratelimit+0x21c/0x460 [ 89.551682][ T35] kauditd_hold_skb.cold+0x41/0x50 [ 89.551686][ T35] ? auditd_pid_vnr+0x230/0x230 [ 89.551689][ T35] kauditd_send_queue+0x19d/0x210 [ 89.551693][ T35] ? audit_log_lost+0x180/0x180 [ 89.551697][ T35] kauditd_thread+0x7f0/0xb80 [ 89.551700][ T35] ? auditd_reset+0x170/0x170 [ 89.551704][ T35] ? finish_wait+0x260/0x260 [ 89.551708][ T35] ? lockdep_hardirqs_on+0x79/0x100 [ 89.551712][ T35] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 89.551716][ T35] ? __kthread_parkme+0x13f/0x1e0 [ 89.551720][ T35] ? auditd_reset+0x170/0x170 [ 89.551723][ T35] kthread+0x3b1/0x4a0 [ 89.551727][ T35] ? kthread_create_worker_on_cpu+0xf0/0xf0 [ 89.551731][ T35] ret_from_fork+0x1f/0x30 [ 89.551735][ T35] Kernel Offset: disabled